garsync 0.1.4__tar.gz → 0.2.0__tar.gz

{garsync-0.1.4 → garsync-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: garsync
-Version: 0.1.4
+Version: 0.2.0
 Summary: 
 Author: Manu
 Author-email: mlorentedev@gmail.com
@@ -9,16 +9,16 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: fastapi (>=0.115.0,<1.0.0)
-Requires-Dist: garminconnect (>=0.2.38,<0.3.0)
-Requires-Dist: pandas (<3)
-Requires-Dist: plotly (>=6.5.2,<7.0.0)
-Requires-Dist: pydantic (>=2.12.5,<3.0.0)
-Requires-Dist: rich (>=14.3.3,<15.0.0)
-Requires-Dist: streamlit (>=1.54.0,<2.0.0)
+Requires-Dist: fastapi (>=0.141.1,<1.0.0)
+Requires-Dist: garminconnect (>=0.3.11,<0.4.0)
+Requires-Dist: pandas (<4)
+Requires-Dist: plotly (>=7.0.0,<8.0.0)
+Requires-Dist: pydantic (>=2.13.4,<3.0.0)
+Requires-Dist: rich (>=15.0.0,<16.0.0)
+Requires-Dist: streamlit (>=1.62.0,<2.0.0)
 Requires-Dist: tenacity (>=9.1.4,<10.0.0)
-Requires-Dist: typer (>=0.24.1,<0.25.0)
-Requires-Dist: uvicorn[standard] (>=0.34.0,<1.0.0)
+Requires-Dist: typer (>=0.27.1,<0.28.0)
+Requires-Dist: uvicorn[standard] (>=0.52.4,<1.0.0)
 Description-Content-Type: text/markdown
 
 # GarSync

{garsync-0.1.4 → garsync-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "garsync"
-version = "0.1.4"
+version = "0.2.0"
 description = ""
 authors = [
     {name = "Manu",email = "mlorentedev@gmail.com"}
@@ -8,16 +8,16 @@ authors = [
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
-    "garminconnect (>=0.2.38,<0.3.0)",
-    "pydantic (>=2.12.5,<3.0.0)",
+    "garminconnect (>=0.3.11,<0.4.0)",
+    "pydantic (>=2.13.4,<3.0.0)",
     "tenacity (>=9.1.4,<10.0.0)",
-    "typer (>=0.24.1,<0.25.0)",
-    "rich (>=14.3.3,<15.0.0)",
-    "pandas (<3)",
-    "streamlit (>=1.54.0,<2.0.0)",
-    "plotly (>=6.5.2,<7.0.0)",
-    "fastapi (>=0.115.0,<1.0.0)",
-    "uvicorn[standard] (>=0.34.0,<1.0.0)",
+    "typer (>=0.27.1,<0.28.0)",
+    "rich (>=15.0.0,<16.0.0)",
+    "pandas (<4)",
+    "streamlit (>=1.62.0,<2.0.0)",
+    "plotly (>=7.0.0,<8.0.0)",
+    "fastapi (>=0.141.1,<1.0.0)",
+    "uvicorn[standard] (>=0.52.4,<1.0.0)",
 ]
 
 
@@ -30,15 +30,15 @@ garsync = "garsync.cli:app"
 
 [dependency-groups]
 dev = [
-    "typer (>=0.24.1,<0.25.0)",
-    "rich (>=14.3.3,<15.0.0)",
-    "pydantic (>=2.12.5,<3.0.0)",
-    "pytest (>=9.0.2,<10.0.0)",
-    "pytest-cov (>=7.0.0,<8.0.0)",
-    "mypy (>=1.19.1,<2.0.0)",
-    "ruff (>=0.15.4,<0.16.0)",
-    "pytest-mock (>=3.0.0,<4.0.0)",
-    "httpx (>=0.28.0,<1.0.0)"
+    "typer (>=0.27.1,<0.28.0)",
+    "rich (>=15.0.0,<16.0.0)",
+    "pydantic (>=2.13.4,<3.0.0)",
+    "pytest (>=9.1.1,<10.0.0)",
+    "pytest-cov (>=7.1.0,<8.0.0)",
+    "mypy (>=2.3.1,<3.0.0)",
+    "ruff (>=0.16.5,<0.17.0)",
+    "pytest-mock (>=3.15.1,<4.0.0)",
+    "httpx (>=0.28.1,<1.0.0)"
 ]
 
 [tool.mypy]
@@ -60,3 +60,7 @@ addopts = "-q"
 [tool.ruff]
 target-version = "py312"
 line-length = 100
+
+[tool.ruff.lint]
+[tool.ruff.lint.flake8-bugbear]
+extend-immutable-calls = ["fastapi.Depends", "fastapi.Query"]

{garsync-0.1.4 → garsync-0.2.0}/src/garsync/__init__.py

@@ -1,3 +1,3 @@
 """Garmin Sync Microservice"""
 
-__version__ = "0.1.4"
+__version__ = "0.2.0"

garsync-0.2.0/src/garsync/api/auth.py

@@ -0,0 +1,166 @@
+"""SEC-001 auth primitives: signed session cookies, login rate limiter, login page.
+
+Stdlib only (hmac/hashlib/secrets) — no new dependencies. The session signing key
+IS the access password: rotating the password invalidates all sessions (accepted
+in specs/SEC-001/proposal.md).
+"""
+
+import hashlib
+import hmac
+import time
+
+SESSION_COOKIE_NAME = "garsync_session"
+SESSION_TTL_SECONDS = 7 * 24 * 3600
+
+LOGIN_MAX_FAILURES = 5
+LOGIN_WINDOW_SECONDS = 300
+
+_LOGIN_PAGE_HTML = """<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="robots" content="noindex, nofollow" />
+    <meta name="color-scheme" content="dark" />
+    <title>Sign in</title>
+    <style>
+      :root {
+        color-scheme: dark;
+        --bg: #0f172a;
+        --card: #1e293b;
+        --line: #334155;
+        --text: #f8fafc;
+        --muted: #94a3b8;
+        --accent: #60a5fa;
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0; min-height: 100vh; min-height: 100dvh; padding: 1.5rem 1rem;
+        display: flex; align-items: center; justify-content: center;
+        background: var(--bg); color: var(--text);
+        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+        font-size: 16px; line-height: 1.5; -webkit-font-smoothing: antialiased;
+      }
+      main {
+        width: 100%; max-width: 22rem; padding: 1.75rem;
+        background: var(--card); border: 1px solid var(--line);
+        border-radius: 0.75rem; box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.35);
+      }
+      h1 { margin: 0 0 0.25rem; font-size: 1.5rem; font-weight: 700; color: var(--accent); }
+      .hint { margin: 0 0 1.25rem; color: var(--muted); font-size: 0.875rem; }
+      label {
+        display: block; margin-bottom: 0.375rem;
+        font-size: 0.75rem; font-weight: 600; text-transform: uppercase;
+        letter-spacing: 0.05em; color: var(--muted);
+      }
+      input[type="password"] {
+        width: 100%; padding: 0.625rem 0.75rem; font: inherit;
+        color: var(--text); background: var(--bg);
+        border: 1px solid var(--line); border-radius: 0.5rem; letter-spacing: 0.02em;
+      }
+      input[type="password"]:hover { border-color: var(--muted); }
+      :focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+      button {
+        width: 100%; margin-top: 1rem; padding: 0.625rem 1rem;
+        border: 0; border-radius: 0.5rem; font: inherit; font-weight: 600;
+        background: #2563eb; color: var(--text); cursor: pointer;
+      }
+      button:hover { background: #1d4ed8; }
+      .error {
+        margin: 0 0 1.25rem; padding: 0.625rem 0.75rem; font-size: 0.875rem;
+        color: #fca5a5; background: rgb(127 29 29 / 0.28);
+        border: 1px solid #7f1d1d; border-left-width: 4px; border-radius: 0.5rem;
+      }
+      .error:empty { display: none; }
+      footer { margin-top: 1.25rem; color: var(--muted); font-size: 0.75rem; }
+      @media (min-width: 40rem) { main { padding: 2rem; } }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>Sign in</h1>
+      <p class="hint">This dashboard is private. Enter the access password to continue.</p>
+
+      <div class="error" role="alert">{{ERROR}}</div>
+
+      <form method="POST" action="/login">
+        <label for="password">Password</label>
+        <input
+          id="password"
+          name="password"
+          type="password"
+          autocomplete="current-password"
+          autocapitalize="off"
+          spellcheck="false"
+          maxlength="256"
+          required
+          autofocus
+        />
+        <button type="submit">Sign in</button>
+      </form>
+
+      <footer>Repeated failed attempts are temporarily blocked.</footer>
+    </main>
+  </body>
+</html>
+"""
+
+
+def render_login_page(error: str = "") -> str:
+    """Render the login page with the error banner filled (empty collapses it)."""
+    return _LOGIN_PAGE_HTML.replace("{{ERROR}}", error)
+
+
+def make_session_token(access_password: str, now: float | None = None) -> str:
+    """Return '<expiry>.<hmac>' — signature keyed by the access password."""
+    current = time.time() if now is None else now
+    expiry = int(current + SESSION_TTL_SECONDS)
+    payload = f"garsync-session|{expiry}"
+    sig = hmac.new(access_password.encode(), payload.encode(), hashlib.sha256).hexdigest()
+    return f"{expiry}.{sig}"
+
+
+def verify_session_token(token: str | None, access_password: str, now: float | None = None) -> bool:
+    """Constant-time token verification; False on tamper, bad format or expiry."""
+    if not token or not access_password:
+        return False
+    parts = token.split(".", 1)
+    if len(parts) != 2 or not parts[0].isdigit():
+        return False
+    expiry_str, provided_sig = parts
+    expected = hmac.new(
+        access_password.encode(),
+        f"garsync-session|{expiry_str}".encode(),
+        hashlib.sha256,
+    ).hexdigest()
+    if not hmac.compare_digest(provided_sig, expected):
+        return False
+    current = time.time() if now is None else now
+    return int(expiry_str) > current
+
+
+class LoginRateLimiter:
+    """In-memory per-client-IP limiter for failed logins (single-process apps)."""
+
+    def __init__(
+        self, max_failures: int = LOGIN_MAX_FAILURES, window_seconds: int = LOGIN_WINDOW_SECONDS
+    ) -> None:
+        self.max_failures = max_failures
+        self.window_seconds = window_seconds
+        self._failures: dict[str, list[float]] = {}
+
+    def _purge(self, client_ip: str) -> list[float]:
+        cutoff = time.time() - self.window_seconds
+        recent = [t for t in self._failures.get(client_ip, []) if t > cutoff]
+        self._failures[client_ip] = recent
+        return recent
+
+    def is_blocked(self, client_ip: str) -> bool:
+        return len(self._purge(client_ip)) >= self.max_failures
+
+    def record_failure(self, client_ip: str) -> None:
+        self._purge(client_ip)
+        self._failures[client_ip].append(time.time())
+
+    def reset(self, client_ip: str) -> None:
+        self._failures.pop(client_ip, None)

garsync-0.2.0/src/garsync/api/main.py

@@ -0,0 +1,191 @@
+"""FastAPI application factory for garsync."""
+
+import hmac
+import logging
+import os
+import sqlite3
+from collections.abc import AsyncGenerator, Awaitable, Callable
+from contextlib import asynccontextmanager
+from pathlib import Path
+from urllib.parse import parse_qs
+
+from fastapi import FastAPI, Request, Response, status
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+from fastapi.staticfiles import StaticFiles
+
+from garsync.api.auth import (
+    SESSION_COOKIE_NAME,
+    SESSION_TTL_SECONDS,
+    LoginRateLimiter,
+    make_session_token,
+    render_login_page,
+    verify_session_token,
+)
+from garsync.api.routes import activities, biometrics, sleep, stats, sync
+from garsync.db.connection import get_connection
+from garsync.db.schema import init_db
+
+logger = logging.getLogger("garsync.auth")
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
+    """Manage database connection lifecycle."""
+    db_path = os.environ.get("GARSYNC_DB_PATH", "data/garsync.db")
+    conn = get_connection(db_path)
+    init_db(conn)
+    app.state.db = conn
+    yield
+    conn.close()
+
+
+def create_app(conn: sqlite3.Connection | None = None) -> FastAPI:
+    """Create and configure the FastAPI application.
+
+    Args:
+        conn: Optional pre-configured connection (for testing).
+             If provided, lifespan is skipped.
+    """
+    if conn is not None:
+        app = FastAPI(title="GarSync API", version="0.1.0")
+        app.state.db = conn
+    else:
+        app = FastAPI(title="GarSync API", version="0.1.0", lifespan=lifespan)
+
+    access_password = os.environ.get("GARSYNC_ACCESS_PASSWORD")
+    api_key = os.environ.get("GARSYNC_API_KEY")
+    auth_active = bool(access_password or api_key)
+    insecure_cookies = os.environ.get("GARSYNC_INSECURE_COOKIES") == "1"
+    limiter = LoginRateLimiter()
+
+    if not auth_active:
+        logger.warning(
+            "Auth is DISABLED: neither GARSYNC_ACCESS_PASSWORD nor GARSYNC_API_KEY "
+            "is set. The API and dashboard are UNPROTECTED. This is only acceptable "
+            "on a trusted local network."
+        )
+    elif not access_password:
+        logger.warning(
+            "Dashboard is UNAUTHENTICATED: GARSYNC_ACCESS_PASSWORD is not set. "
+            "Only /api/* requires the API key. Set GARSYNC_ACCESS_PASSWORD before "
+            "deploying publicly."
+        )
+
+    @app.middleware("http")
+    async def auth_gate(
+        request: Request, call_next: Callable[[Request], Awaitable[Response]]
+    ) -> Response:
+        """SEC-001 gate: session cookie for pages, session-or-API-key for /api/*.
+
+        401 = no credentials presented; 403 = credentials presented but invalid.
+        """
+        if not auth_active:
+            return await call_next(request)
+
+        path = request.url.path
+        if path in ("/login", "/logout"):
+            return await call_next(request)
+
+        if path.startswith("/api/"):
+            if api_key:
+                provided = request.headers.get("X-API-KEY")
+                if provided is not None:
+                    if hmac.compare_digest(provided, api_key):
+                        return await call_next(request)
+                    return JSONResponse(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        content={"detail": "Invalid API key"},
+                    )
+            if access_password and verify_session_token(
+                request.cookies.get(SESSION_COOKIE_NAME), access_password
+            ):
+                return await call_next(request)
+            return JSONResponse(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                content={"detail": "Authentication required"},
+            )
+
+        if access_password:
+            if verify_session_token(request.cookies.get(SESSION_COOKIE_NAME), access_password):
+                return await call_next(request)
+            return RedirectResponse("/login", status_code=status.HTTP_302_FOUND)
+
+        return await call_next(request)
+
+    @app.get("/login", include_in_schema=False)
+    async def login_page(request: Request) -> Response:
+        error = "Invalid password. Try again." if "error" in request.query_params else ""
+        return HTMLResponse(render_login_page(error))
+
+    @app.post("/login", include_in_schema=False)
+    async def login_submit(request: Request) -> Response:
+        client_ip = request.client.host if request.client else "unknown"
+        if limiter.is_blocked(client_ip):
+            return HTMLResponse(
+                render_login_page("Too many failed attempts. Try again later."),
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            )
+
+        form = parse_qs((await request.body()).decode())
+        supplied = form.get("password", [""])[0]
+
+        if access_password and hmac.compare_digest(supplied, access_password):
+            limiter.reset(client_ip)
+            response = RedirectResponse("/", status_code=status.HTTP_303_SEE_OTHER)
+            response.set_cookie(
+                SESSION_COOKIE_NAME,
+                make_session_token(access_password),
+                max_age=SESSION_TTL_SECONDS,
+                httponly=True,
+                samesite="lax",
+                secure=not insecure_cookies,
+            )
+            return response
+
+        limiter.record_failure(client_ip)
+        return HTMLResponse(
+            render_login_page("Invalid password. Try again."),
+            status_code=status.HTTP_401_UNAUTHORIZED,
+        )
+
+    @app.post("/logout", include_in_schema=False)
+    async def logout() -> Response:
+        response = RedirectResponse("/login", status_code=status.HTTP_303_SEE_OTHER)
+        response.delete_cookie(SESSION_COOKIE_NAME)
+        return response
+
+    allowed_origins = [
+        origin.strip()
+        for origin in os.environ.get("GARSYNC_ALLOWED_ORIGINS", "").split(",")
+        if origin.strip()
+    ]
+    if "*" in allowed_origins:
+        msg = (
+            "GARSYNC_ALLOWED_ORIGINS must list explicit origins; '*' is not allowed "
+            "because the API uses credentialed (cookie / X-API-KEY) requests."
+        )
+        raise ValueError(msg)
+    if allowed_origins:
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=allowed_origins,
+            allow_credentials=True,
+            allow_methods=["GET", "POST"],
+            allow_headers=["X-API-KEY", "Content-Type"],
+        )
+
+    app.include_router(activities.router)
+    app.include_router(biometrics.router)
+    app.include_router(sleep.router)
+    app.include_router(stats.router)
+    app.include_router(sync.router)
+
+    static_dir = Path(__file__).resolve().parents[3] / "frontend" / "dist"
+    if static_dir.is_dir():
+        app.mount("/", StaticFiles(directory=str(static_dir), html=True), name="static")
+
+    return app
+
+
+app = create_app()

{garsync-0.1.4 → garsync-0.2.0}/src/garsync/api/routes/activities.py

@@ -1,6 +1,6 @@
 """Activity endpoints."""
 
-from typing import Optional
+import datetime
 
 from fastapi import APIRouter, Depends, Query
 
@@ -15,17 +15,17 @@ router = APIRouter(prefix="/api", tags=["activities"])
 def list_activities(
     page: int = Query(default=1, ge=1),
     limit: int = Query(default=20, ge=1, le=100),
-    start_date: Optional[str] = Query(default=None),
-    end_date: Optional[str] = Query(default=None),
-    activity_type: Optional[str] = Query(default=None),
+    start_date: datetime.date | None = Query(default=None),
+    end_date: datetime.date | None = Query(default=None),
+    activity_type: str | None = Query(default=None),
     repo: ActivityRepository = Depends(get_activity_repo),
 ) -> PaginatedActivities:
     """List activities with pagination and optional filters."""
     rows, total = repo.get_paginated(
         page=page,
         limit=limit,
-        start_date=start_date,
-        end_date=end_date,
+        start_date=start_date.isoformat() if start_date else None,
+        end_date=end_date.isoformat() if end_date else None,
         activity_type=activity_type,
     )
     items = [ActivityItem(**dict(row)) for row in rows]

{garsync-0.1.4 → garsync-0.2.0}/src/garsync/api/routes/biometrics.py

@@ -1,5 +1,7 @@
 """Biometrics endpoints."""
 
+import datetime
+
 from fastapi import APIRouter, Depends, Query
 
 from garsync.api.deps import get_biometrics_repo
@@ -11,16 +13,16 @@ router = APIRouter(prefix="/api", tags=["biometrics"])
 
 @router.get("/biometrics", response_model=BiometricsResponse)
 def list_biometrics(
-    start_date: str = Query(),
-    end_date: str = Query(),
+    start_date: datetime.date = Query(),
+    end_date: datetime.date = Query(),
     repo: BiometricsRepository = Depends(get_biometrics_repo),
 ) -> BiometricsResponse:
     """List biometrics within a date range."""
-    rows = repo.get_by_date_range(start_date, end_date)
+    rows = repo.get_by_date_range(start_date.isoformat(), end_date.isoformat())
     metrics = [BiometricItem(**dict(row)) for row in rows]
     return BiometricsResponse(
         metrics=metrics,
-        start_date=start_date,
-        end_date=end_date,
+        start_date=start_date.isoformat(),
+        end_date=end_date.isoformat(),
         count=len(metrics),
     )

{garsync-0.1.4 → garsync-0.2.0}/src/garsync/api/routes/sleep.py

@@ -1,5 +1,7 @@
 """Sleep endpoints."""
 
+import datetime
+
 from fastapi import APIRouter, Depends, Query
 
 from garsync.api.deps import get_sleep_repo
@@ -11,16 +13,16 @@ router = APIRouter(prefix="/api", tags=["sleep"])
 
 @router.get("/sleep", response_model=SleepResponse)
 def list_sleep(
-    start_date: str = Query(),
-    end_date: str = Query(),
+    start_date: datetime.date = Query(),
+    end_date: datetime.date = Query(),
     repo: SleepRepository = Depends(get_sleep_repo),
 ) -> SleepResponse:
     """List sleep sessions within a date range."""
-    rows = repo.get_by_date_range(start_date, end_date)
+    rows = repo.get_by_date_range(start_date.isoformat(), end_date.isoformat())
     sessions = [SleepItem(**dict(row)) for row in rows]
     return SleepResponse(
         sleep_sessions=sessions,
-        start_date=start_date,
-        end_date=end_date,
+        start_date=start_date.isoformat(),
+        end_date=end_date.isoformat(),
         count=len(sessions),
     )

{garsync-0.1.4 → garsync-0.2.0}/src/garsync/api/routes/stats.py

@@ -1,7 +1,6 @@
 """Stats endpoints — summary and heatmap."""
 
-from datetime import date, timedelta
-from typing import Optional
+from datetime import UTC, date, datetime, timedelta
 
 from fastapi import APIRouter, Depends, Query
 
@@ -23,11 +22,11 @@ router = APIRouter(prefix="/api/stats", tags=["stats"])
 
 def _resolve_dates(
     period: str,
-    start_date: Optional[str],
-    end_date: Optional[str],
+    start_date: str | None,
+    end_date: str | None,
 ) -> tuple[str, str]:
     """Resolve start/end dates from period or explicit params."""
-    today = date.today()
+    today = datetime.now(UTC).date()
     if start_date and end_date:
         return start_date, end_date
     if period == "week":
@@ -42,14 +41,18 @@ def _resolve_dates(
 @router.get("/summary", response_model=SummaryStats)
 def summary(
     period: str = Query(default="week"),
-    start_date: Optional[str] = Query(default=None),
-    end_date: Optional[str] = Query(default=None),
+    start_date: date | None = Query(default=None),
+    end_date: date | None = Query(default=None),
     activity_repo: ActivityRepository = Depends(get_activity_repo),
     biometrics_repo: BiometricsRepository = Depends(get_biometrics_repo),
     sleep_repo: SleepRepository = Depends(get_sleep_repo),
 ) -> SummaryStats:
     """Get aggregated stats for a period."""
-    sd, ed = _resolve_dates(period, start_date, end_date)
+    sd, ed = _resolve_dates(
+        period,
+        start_date.isoformat() if start_date else None,
+        end_date.isoformat() if end_date else None,
+    )
 
     activity_stats = activity_repo.get_summary_stats(sd, ed)
     bio_stats = biometrics_repo.get_avg_stats(sd, ed)
@@ -92,12 +95,12 @@ def _compute_intensity(count: int, max_count: int) -> int:
 
 @router.get("/heatmap", response_model=HeatmapResponse)
 def heatmap(
-    year: Optional[int] = Query(default=None),
-    activity_type: Optional[str] = Query(default=None),
+    year: int | None = Query(default=None),
+    activity_type: str | None = Query(default=None),
     repo: ActivityRepository = Depends(get_activity_repo),
 ) -> HeatmapResponse:
     """Get activity heatmap data for a year."""
-    target_year = year or date.today().year
+    target_year = year or datetime.now(UTC).date().year
     rows = repo.get_heatmap_data(target_year, activity_type)
 
     max_count = max((row["activity_count"] for row in rows), default=0)